feat: make MoneyAccountUpgradeController own its bootstrap - #10072
Open
Jwhiles wants to merge 8 commits into
Open
feat: make MoneyAccountUpgradeController own its bootstrap#10072Jwhiles wants to merge 8 commits into
Jwhiles wants to merge 8 commits into
Conversation
Contributor
Author
|
@metamaskbot publish-preview |
1 similar comment
Contributor
Author
|
@metamaskbot publish-preview |
Contributor
|
Preview builds have been published. Learn how to use preview builds in other projects. Expand for full list of packages and versions. |
Contributor
|
Preview builds have been published. Learn how to use preview builds in other projects. Expand for full list of packages and versions. |
Contributor
Author
|
@metamaskbot publish-preview |
Contributor
|
Preview builds have been published. Learn how to use preview builds in other projects. Expand for full list of packages and versions. |
Jwhiles
added a commit
to MetaMask/metamask-extension
that referenced
this pull request
Sep 2, 2026
MoneyAccountUpgradeController (core PR MetaMask/core#10072) now owns its bootstrap: it watches the feature-flag and keyring state, parses the vault config, and serializes its own re-inits. The extension supplies only the client-specific parts as hooks — the basic-functionality gate inside isEnabled, the fail-closed geo check as isEligible, the shared Money chain configurator, and Sentry reporting for a missing vault config — and MoneyAccountUpgradeService is deleted. Per review feedback, no messenger calls happen at construction: metamask-controller calls controller.init() once everything is built, alongside the other post-construction init() calls, so the init map no longer carries ordering constraints. Onboarding and preferences changes re-trigger the controller's gating through its public sync(). The package is pinned to a preview build until core releases @metamask/money-account-upgrade-controller@4.0.0 and @metamask/money-account-utils@1.2.0; the resolutions entries and the ^3.0.2 dependency swap to ^4.0.0 / ^1.2.0 then. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
7 tasks
Jwhiles
force-pushed
the
money-account-upgrade-controller-owned-bootstrap
branch
from
September 2, 2026 12:25
1ee21f9 to
4258cb1
Compare
Jwhiles
marked this pull request as ready for review
September 2, 2026 12:28
Jwhiles
changed the title
Jwhiles
force-pushed
the
money-account-upgrade-controller-owned-bootstrap
branch
from
September 2, 2026 12:30
4258cb1 to
81700ed
Compare
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 81700ed. Configure here.
cursor
Bot
requested review from
FrederikBolding,
MoMannn,
ccharly and
ffmcgee725
September 2, 2026 12:38
ffmcgee725
previously approved these changes
Sep 2, 2026
Contributor
Author
|
@metamaskbot publish-preview |
2 similar comments
Contributor
Author
|
@metamaskbot publish-preview |
Contributor
Author
|
@metamaskbot publish-preview |
The controller now subscribes to RemoteFeatureFlagController and KeyringController state, parses the moneyAccountVaultConfig flag, and runs its own serialized bootstrap, replacing the client-side services that previously drove init() externally. Client-specific concerns (version-gated enable flag, eligibility checks, adding the vault chain, error reporting) are supplied as constructor hooks. - BREAKING: init() is now the no-argument lifecycle entry point (subscribe and sync); the config-arming routine is internal and driven by the moneyAccountVaultConfig remote feature flag - BREAKING: the constructor requires a hooks option with an isEnabled hook - upgradeAccount() now waits for an in-flight bootstrap instead of throwing, and refuses to run against a stale config after the feature is disabled - Add vault-config parsing and comparison helpers to @metamask/money-account-utils, shared by the controller and both clients Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
A disarm (isEnabled flipping off) or a newer scheduled config during the CHOMP service-details call now supersedes the in-flight run instead of the run arming a config the controller had already dropped. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Scheduling a bootstrap for a changed vault config now disarms the armed config, so upgradeAccount waits for the re-bootstrap (or refuses if it failed) instead of signing delegations against the old vault. The wait also follows runs chained onto the bootstrap while waiting, so a call that captured a superseded run no longer throws while its successor is still running. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
- Make `underlyingToken` optional in the shared vault-config parser so flags that predate the field still parse, matching the balance service - Re-check the armed config before every upgrade step and abort if it is disarmed or superseded mid-sequence - Refuse `upgradeAccount` while the wallet is locked - Contain a throwing `onBootstrapError` hook so the failed bootstrap is still retried and nothing escapes `init()` or `sync()` Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Jwhiles
force-pushed
the
money-account-upgrade-controller-owned-bootstrap
branch
from
September 2, 2026 14:08
a302de5 to
6ec257f
Compare
Contributor
Author
|
@metamaskbot publish-preview |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Explanation
This updates the money account upgrade controller to make it better able to handle its own initialisation. At the moment clients have to manage initialising the controller, leading to a lot of shared code. This PR tries to move that logic into the controller itself as much as possible
Key changes:
RemoteFeatureFlagController:stateChangedandKeyringController:stateChangedand uses this information to bootstrap itself.init()now takes no arguments, and merely sets up subscriptions to to some messenger events.hooksoption for the parts of the upgrade flow that can only be determined in the client.upgradeAccount()waits for an in-flight bootstrap instead of throwing (replacing mobile's module-levelwhenMoneyAccountUpgradeReadypromise), and is disarmed whenisEnabledflips off so it cannot run against a stale config.sync()lets clients re-trigger the bootstraps checks from client-only signals - for example onboarding being completed.@metamask/money-account-utils(getMoneyAccountVaultConfig,parseMoneyAccountVaultConfig,areMoneyAccountVaultConfigsEqual,MoneyAccountVaultConfig), shared by the controller and both clients.References
app/core/Engine/controllers/money-account-upgrade-controller-init.ts(follow-up PR required)Checklist
Note
High Risk
Changes when and against which vault config upgrade signing runs, including mid-sequence abort and disarm rules, plus breaking bootstrap APIs that all clients must migrate correctly.
Overview
Money Account upgrade initialization moves from client-orchestrated
init({ chainId, boringVaultAddress })intoMoneyAccountUpgradeController, which watches remote feature flags and keyring state and runs a serialized bootstrap when gates pass.Breaking client contract: the constructor now requires
hooks(isEnabled, optionalisEligible,ensureChainConfigured,onBootstrapError);init()is a one-time no-arg subscribe + first sync; the messenger must allowRemoteFeatureFlagController/KeyringControllergetState and stateChanged. Vault parameters come from themoneyAccountVaultConfigflag via new@metamask/money-account-utilshelpers (getMoneyAccountVaultConfig,parseMoneyAccountVaultConfig,areMoneyAccountVaultConfigsEqual,MissingMoneyAccountVaultConfigError).upgradeAccount()waits for in-flight bootstrap instead of failing immediately, refuses when not armed (disabled, locked, or failed bootstrap), and aborts mid-sequence if the config is disarmed or superseded so later steps do not sign. A publicsync()re-runs gate checks for client-only signals (e.g. onboarding).Bootstrap failures surface through
onBootstrapError(including once-per-lifetime missing/malformed vault config); tests and changelogs document the new gating, chaining, and retry behavior.Reviewed by Cursor Bugbot for commit ad38c64. Bugbot is set up for automated code reviews on this repo. Configure here.